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REMARKS 

This Application has been carefully reviewed in light of the Office Action 
electronically mailed February 27, 2008. Applicant respectfully requests reconsideration and 
favorable action in this case. Claims 1-5, 7-10, 12-21, 23-26, 28-37, 39-42, and 44-60 are 
currently pending. Applicant respectfully requests reconsideration and allowance of all 
pending claims. 

Rejections under 35 U.S.C. $ 103 

The Office Action rejects Claims 1-5, 12-21, 28-37, and 44-48 under 35 U.S.C. 
§ 103(a) as being unpatentable over McGee in view of U.S. Patent No. 5,440,723 issued to 
Arnold et al. ("Arnold"). Applicant respectfully traverses these rejections. 

Claim 1 is directed to a method for maintaining computer security. The method 
includes providing a database of known good software and a database of unfamiliar software. 
The method further includes, for the identified file, determining whether an entry exists in the 
database of known good software and determining whether an entry exists in the database of 
unfamiliar software. The method further includes moving the entry from the database of 
unfamiliar software to the database of known good software if it is determined that the entry 
has been in the database of unfamiliar software for a sufficient period of time. Applicant 
respectfully contends that the proposed McGee-Arnold combination fails to disclose, teach, or 
suggest each and every one of these limitations. 

The Office Action admits that McGee fails to disclose the limitations "providing a 
database of unfamiliar software" or "moving the entry from the database of unfamiliar 
software to the database of known good software if it is determined that the entry has been in 
the database of unfamiliar software for a sufficient period of time. 5 ' Office Action, pg. 4-5. 
The Office Action relies on Arnold for disclosing these limitations. Office Action, pg. 5. 

Arnold discloses an immune system for computers. When anomalous behavior is 
detected, a scanner operates to detect whether it is a known type of undesirable software by 
comparing valid signatures from a signature database . Arnold, col. 28, lines 48-58. If the 
scanner fails to detect a known type of undesirable software entity, a decoy program unit is 
then used to isolate the undesirable software entity and identify code portions as candidate 
signatures. Arnold, col. 29, lines 1-17. After the candidate signature is processed, a valid 
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signature for the previously unknown type of undesirable software is stored within the 
signature database . Arnold, col. 29, lines 18-22. 

Therefore, the signature database disclosed by Arnold contains valid signatures of 
known undesirable software. Thus, Applicant respectfully contends that this database fails to 
disclose "a database of unfamiliar software." Furthermore, Arnold discloses that previously 
unknown software is processed to generate valid signatures. These valid signatures may be 
stored, alongside other signatures of undesirable software in the signature database. Thus, 
Applicant respectfully contends that Arnold fails to disclose moving an entry to a "database 
of known good software." Finally, Arnold fails to disclose "moving the entry from the 
database of unfamiliar software to the database of known good software if it is determined 
that the entry has been in the database of unfamiliar software for a sufficient period of time ." 
For at least these reasons, Applicant respectfully requests that the rejection of Claim 1 be 
withdrawn. 

Claims 2-5 and 12-16 depend, either directly or indirectly, from Claim 1 and 
incorporate all the limitations thereof. Therefore, for at least the reasons discussed above 
with regard to Claim 1, Applicant respectfully requests that the rejection of Claims 2-5 and 
12-16 be withdrawn. 

Similar to Claim 1, Claims 17 and 33 includes limitations related to providing a 
database of unfamiliar software and moving the entry from the database of unfamiliar 
software to the database of known good software if it is determined that the entry has been in 
the database of unfamiliar software for a sufficient period of time. For at least those reasons 
discussed above with regard to Claim 1, Applicant respectfully requests that the rejection of 
Claims 17 and 33 be withdrawn. 

Claims 18-21 and 28-32 depend, either directly or indirectly, from Claim 17 and 
incorporate all the limitations thereof. Claims 34-37 and 44-48 depend, either directly or 
indirectly from Claim 33 and incorporate all the limitations thereof. Therefore, for at least 
the reasons discussed above, Applicant respectfully requests that the rejection of Claims 18- 
21, 28-32, 34-37, and 44-48 be withdrawn. 

The Office Action rejects Claims 7, 23, and 39 under 35 U.S.C. § 103(a) as being 
unpatentable over McGee in view of Arnold and further in view of Liu. The Office Action 
rejects Claims 10, 26, and 42 under 35 U.S.C. § 103(a) as being unpatentable over McGee and 
of Arnold in view of Liu and further in view of Verma. The Office Action rejects Claims 8-9, 
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24-25, 40-41, 49, 51, and 54 under 35 U.S.C. § 103(a) as being unpatentable over McGee in 
view of Arnold in further view of Verma. The Office Action rejects Claims 50, 52, and 55 
under 35 U.S.C. § 103(a) as being unpatentable over McGee in view of Arnold and Verma in 
view of Christenson. 

Claims 7-10 and 49-50 each depend, either directly or indirectly, from Claim 1 and 
incorporate all the limitations thereof Claims 23-26, 29, and 51-52 each depend, either 
directly or indirectly, from Claim 17 and incorporate all the limitations thereof. Claims 39-42 
and 54-55 each depend, either directly or indirectly, from Claim 33 and incorporate all the 
limitations thereof. As shown above, the proposed McGee-Arnold combination fails to 
disclose, teach, or suggest each and every limitation of Claims 1,17, and 33. Neither Liu, 
Verma, nor Christenson cure these deficiencies. Therefore, Applicant respectfully contends 
that the rejections of Claims 7-10, 23-26, 29, 39-42, 49-52, and 54-55 be withdrawn, for at 
least the same reasons as their respective base claims. 

The Office Action rejects Claim 56 under 35 U.S.C. § 103(a) as being unpatentable 
over McGee in view of Verma. Applicant respectfully traverses this rejection. 

Claim 56 is directed to a method for computer security. The method includes 
identifying a file. The method also includes determining quantitative information regarding 
the file, the quantitative information selected from the group consisting of a length of time the 
entry has been in the database of unfamiliar software, a number of times the file has been 
opened, and a number of times an executable in the file has been executed. The method 
further includes adding an entry for the file to a database of known good software if the 
quantitative information exceeds a predetermined value. Applicant respectfully contends that 
the proposed McGee-Verma combination fails to disclose, teach, or suggest each and every 
one of these limitations. 

McGee discloses a system and method for controlling program execution. McGee, 
col. 3, lines 64-65. When a program is designated for execution, a hash value generator is 
used to generate a hash of the program and compare "the generated hash value with the stored 
hash values on the approved hash list /' McGee, col. 11, lines 40-46 (emphasis added). 
Applicant respectfully contends that this "approved hash list" is not a database of unfamiliar 
software. In fact, the Office Action even admits that McGee fails to disclose "providing a 
database of unfamiliar software." Office Action, pg. 4. Therefore, Applicant respectfully 
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contends that McGee fails to disclose, teach, or suggest determining whether an entry for a 
file exists in a database of unfamiliar software . 

Furthermore, Applicant respectfully contends that McGee fails to disclose, teach, or 
suggest "adding an entry for the file to a database of known good software if the quantitative 
information exceeds a predetermined value." As described above, McGee discloses 
comparing a hash value generated for a program with a list of stored hash values on an 
approved list. If a match is found, the program is allowed to execute. McGee, col. 11, lines 
46-49. However, if there is no match, the system prevents the executable file data from 
executing. McGee, col. 11, lines 54-57. This does not disclose, teach, or suggest quantitative 
information or a predetermined value. Furthermore, it fails to disclose, teach, or suggest 
adding an entry to a database of known good software if the quantitative information exceeds 
a predetermined value. Verma fails to cure these deficiencies. For at least these reasons, 
Applicant respectfully requests that the rejection of Claim 56 be withdrawn. 

The Office Action rejects Claims 57-60 under 35 U.S.C. § 103(a) as being 
unpatentable over McGee in view of Verma in further view of Arnold. Claims 57-60 
depend, either directly or indirectly from Claim 56 and incorporate all the limitations thereof. 
As shown above, the proposed McGee-Verma combination fails to disclose, teach, or suggest 
each and every element of Claim 56. Arnold fails to cure this deficiency. Therefore, for at 
least the reasons discussed above, Applicant respectfully contends that the rejections of 
Claims 57-60 be withdrawn. 
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Conclusion 



Applicant has made an earnest attempt to place this case in condition for allowance. 
For the foregoing reasons, and for other apparent reasons, Applicant respectfully requests full 
allowance of all pending Claims. If the Examiner feels that a telephone conference or an 
interview would advance prosecution of this Application in any manner, the undersigned 
attorney for Applicant stands ready to conduct such a conference at the convenience of the 
Examiner. 

Although Applicant believes no fee is due, the Commissioner is hereby authorized to 
charge any required fee or credit any overpayment to Deposit Account No. 02-0384 of Baker 
Botts L.L.P. 




Respectfully submitted, 

BAKER BOTTS L.L.P. 
AttetneyslorA^plicant 




Luke KTPedersen 
Reg. No. 45,003 
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